As said, there are 12 security notes that we need to review this month. That is not a huge number but remember it is not the number that counts but identifying what notes are relevant for your landscape. To make a non-IT analogy: a burglar does not need 12 ways into your house, one way will do just fine…

HotNews

SAP note 3479478 has again been updated this month and that’s the 3^rd time in a row this note is part of the monthly release. This time, a patch has been made available for version 420 of the Business Objects platform. So should you have applied a workaround so far, there is a patch available now.

High priority

Many software packages make use of open source libraries and with SAP packages that is no exception. When there is an issue with those libraries, a software patch is required to make sure secure versions of those libraries are used. SAP note 3523541 describes such a situation for SAP Enterprise Project Connection. So if you need this component for integration scenarios, please apply the patch!

SAP note 3478615 addresses once again a vulnerability that allows malicious file uploads. Looking back at the monthly patch rounds of last year, it is remarkable how this is a common attack vector. This time, it concerns the Business Objects platform on the Web Intelligence component. Very important: applying the patch is not enough! You need to create a file on the server as described in the note to really fix this vulnerability.

SAP note 3483344 concerns an update about a missing authorization check for which there is now also a patch available for SEM-BW systems. If you have systems with these components, review and apply the patch where needed.

Medium priority

All other notes of this month’s release have a medium priority and are either new or updated. Most of the notes simply require the patch or correction to be applied. Some highlights are:

• Note 3520100: this vulnerability affects the SAP HANA client, a separate client that can be installed to integrate 3^rd party systems with SAP HANA databases. This is a typical example of an application that is overlooked in IT landscapes. Take note of the update when using the client!
• Note 3481588: the note has been updated with correction instructions for SAP BW 700 to 702 releases. Review if applicable.
• Note 3479293: this note turns out to be only relevant for product SLCM or the switch ISHERCM_MAIN is activated.
• Note 3454858: manual instructions have been extensively enhancement. Review if applicable.